I always run it with --no-self-upgrade but I have to upgrade from time to time if I want it to keep working. We are not talking about some box that will be gone in 3 years. Another client still seems to be the better choice.
Actually that step was only required for the first install.
As the certbot-auto script is deprecated anyway, yes, that might be better indeed. But for the short run, you can run the previous version if you really need to.
You could go totally overboard and completely write your own client like I did. Granted that support and maintenance come from the man in the mirror. 
I guess it's the gold standard, if by that you mean the gold standard for how Let's Encrypt should not be used.
If you're paranoid about security though, it really is the ultimate DIY approach. Fully-downloadable, all-inclusive JS with no key sharing (account or certificate). Tin foil hat optional. 
It seems like most active projects are trending toward docker or snap distribution at this point. Hopefully that'll make snap less painful to use over time, but I really don't see sticking with native distribution as a long-term viable alternative, even acme.sh. Sure would be nice to have a better deprecation message telling you what the successor is, of course.
I beg to differ. I'm running Gentoo and don't use binary packages. Snapd doesn't even run on non-systemd systems. I see docker as a system for people who are new to Linux and need an easy method.
Personally I am fond of agnostic approaches like PHP and JS with minimal/no extension that leave handling the underlying details to the platform. They let me focus on developing and maintaining my client rather than worrying about porting issues.
Fair point. To avoid such dependencies I try to only use the base functionality (i.e. standard libraries almost always included with the base install). I'm not too worried about PHP deprecating openssl or curl.
You mean this install of PHP? Base/basic enough? 
[ebuild R ] dev-lang/php-7.4.9:7.4::gentoo USE="apache2 -acl -argon2 -bcmath -berkdb -bzip2 -calendar -cdb -cgi -cjk -cli (-coverage) -ctype -curl -debug -embed -enchant -exif -ffi -fileinfo -filter (-firebird) -flatfile -fpm -ftp -gd -gdbm -gmp -iconv -imap -inifile -intl -iodbc -ipv6 -json -kerberos -ldap -ldap-sasl -libedit -libressl -lmdb -mhash -mssql -mysql -mysqli -nls -oci8-instant-client -odbc -opcache -pcntl -pdo -phar -phpdbg -posix -postgres -qdbm -readline (-selinux) -session -session-mm -sharedmem -simplexml -snmp -soap -sockets -sodium -spell -sqlite -ssl -systemd -sysvipc -test -threads -tidy -tokenizer -tokyocabinet -truetype -unicode -webp -xml -xmlreader -xmlrpc -xmlwriter -xpm -xslt -zip -zlib" 0 KiB
To be fair, this aren't actually my USE-settings for my PHP 
What did you end up doing? I also rolled my own distro.
